[angusmaul]

Scripts which are clearly AI generated and not further revised by the Author of this PR (in terms of Coding Standards and Script Layout) may be closed without review.

✍️ Description

Adds a helper script for Orb (https://orb.net), a headless internet-quality sensor. It scores responsiveness, reliability and bandwidth into a single Orb Score, runs 24/7, and is free for up to five sensors.

Orb's own docs point self-hosters at Docker for this, but a container runtime is unnecessary. Orb publishes an official apt repository and the package is a single statically linked Go binary plus a systemd unit — so this installs bare-metal from the vendor's own repo via setup_deb822_repo, with nothing pulled out of an image and nothing redistributed by this repo.

Two behaviours specific to Orb shaped the script, both documented in orb.json notes:

1. orb sensor --help starts a second sensor. The sensor subcommand does not implement --help; invoking it launches another sensor process that shares the identity and writes the same filestore, which can register a duplicate device cloud-side. So no install or update path ever invokes orb sensor to probe anything. orb version and orb help are safe and were verified as such.
2. The sensor has identity state. private.key + certificate.crt in /home/orb/.config/orb (mode 700) are the identity — wiping that directory registers a new sensor and orphans all history. update_script() only upgrades the package, which owns just /usr/bin/orb, so that directory is never touched.

A first run leaves the sensor unlinked; the completion message tells the user to run runuser -u orb -- orb link and scan the QR code it prints.

🔗 Related PR / Issue

Link: #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No breaking changes – Existing functionality remains intact.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🏗️ arm64 Support (X in brackets)

• arm64 supported - Tested and supported on arm64.
• arm64 not tested - Assumed to work on arm64, but testing has not been done.
• arm64 not supported - Confirmed upstream dependencies or binaries do not support arm64.

var_arm64="yes" is set. Orb ships an arm64 build in the same main component as amd64 (orb_1.5.3_arm64.deb), and Architectures: is deliberately omitted from the deb822 source so apt resolves whichever the container is. I only had amd64 hardware to test on.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to website-related JSON files or metadata.
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

🔍 Code & Security Review (X in brackets)

• Follows CODE-AUDIT.md & CONTRIBUTING.md guidelines
• Uses correct script structure (AppName.sh, AppName-install.sh, AppName.json)
• No hardcoded credentials
• No Docker / Docker Compose – The application is installed bare-metal; Docker is not used.
• No git pull – Updates use fetch_and_deploy_gh_release, fetch_and_deploy_codeberg_release, fetch_and_deploy_gl_release, or fetch_and_deploy_from_url instead of git pull.

Update is apt install --only-upgrade orb against the vendor repo, the same shape as ct/evcc.sh and ct/grafana.sh in ProxmoxVE. There is no GitHub release to fetch.

---

🤖 AI Assistance (X in brackets)

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

---

📋 Additional Information (optional)

Testing — built from this branch on PVE 9.2.4 into a fresh Debian 13 unprivileged LXC (1 core / 512 MB / 4 GB) and verified:

• orb.service active and enabled; runs /usr/bin/orb sensor as the orb user with AmbientCapabilities=CAP_NET_RAW, which works unprivileged — no privileged container and no feature flags needed.
• Sensor completed real measurements from inside the container (649 Mbps down / 87 Mbps up, Orb Score 93).
• deb822 source and keyring written correctly; orb version reports v1.5.3.
• Identity created at /home/orb/.config/orb (700, orb:orb).
• Update path proven with a real version change, not just a no-op: downgraded to 1.5.2, then ran the update_script() commands to upgrade back to 1.5.3. The service restarted cleanly and private.key/certificate.crt were byte-identical (sha256 unchanged) across the upgrade.
• Disk use after install: 806 MB of 4 GB.

Two deliberate choices a reviewer may want to check:

• A system user is created — normally flagged by AGENTS.md rule 9. It is not created by this script: Orb's own postinst creates it, and the shipped unit hardcodes User=orb. Overriding that would fight the package.
• orb-update.timer is left disabled. The package ships it for Orb's daily self-upgrade, but /usr/bin/orb-update runs apt-get update -o Dir::Etc::sourcelist="sources.list.d/orb.list" — the legacy one-line source. Against the deb822 orb.sources this repo writes, that refreshes nothing (verified: W: Unable to read /etc/apt/sources.list.d/orb.list). Updating through the script is therefore the correct path, and the JSON note says so rather than recommending the timer.

Licensing — Orb is proprietary freeware. Nothing is redistributed here: the script configures Orb's own package repository and installs from Orb's own servers, which is exactly what Orb's documented installer (curl -fsSL https://pkgs.orb.net/install.sh | sh) does. Each user installs under their own grant.

On the new-script criteria below — Orb is closed-source, so it has no GitHub repository, no stars and no release tarballs; those three boxes cannot honestly be ticked. The remaining criteria are met, and there is established precedent for closed-source, vendor-packaged apps in ProxmoxVE (plex, emby, cloudflared, netbird, zerotier-one, unifi-os-server). Happy to drop this if the org would rather not carry it.

---

📦 Application Requirements (for new scripts)

• The application is at least 6 months old
• The application is actively maintained
• The application has 600+ GitHub stars
• Official release tarballs are published
• I understand that not all scripts will be accepted due to various reasons and criteria by the community-scripts ORG

🌐 Source

• Website: https://orb.net/
• Docs: https://orb.net/docs
• Linux install docs: https://orb.net/docs/setup-sensor/linux
• Package repository: https://pkgs.orb.net/stable/debian (suite orb, component main)

[CrazyWolf13]

@MickLesk

[angusmaul]

Thanks @asylumexp — all nine suggestions applied in 1c92710.

• Dropped the explanatory comment blocks from ct/orb.sh and install/orb-install.sh.
• Shortened the completion output to the two link lines.
• Trimmed the notes from six to two and reworded both as suggested.

Re-tested from the updated branch on a fresh Debian 13 unprivileged LXC: service comes up as the orb user, orb version reports v1.5.3, and the update path still upgrades in place without touching the sensor identity.

Also noting my thanks to @MickLesk and @CrazyWolf13 for the keep-open label — Orb is closed-source so the stars/tarball boxes genuinely can't be ticked, and I'd left them unchecked rather than fudge them.

[angusmaul]

You're right — removed in 72a31b4.

I'd copied the shape from evcc.sh/grafana.sh, but on re-reading those the block is a migration shim: it fires when the legacy .list exists so pre-deb822 containers get converted. Orb is a new script with no installs in the wild, so there's nothing to migrate and the check was dead code. update_script() is now just the guard plus apt update / apt install --only-upgrade, matching ddclient.sh.

One change you didn't ask for, so flagging it — I also swapped the guard from command -v orb to dpkg -s orb, matching grafana/loki/kiwix. With the repo block gone the update is purely --only-upgrade, which is a silent no-op if the package isn't installed. Verified in a container with the package purged and a stray binary at /usr/local/bin/orb:

OLD guard (command -v): PASS -> proceeds to a no-op apt upgrade and reports success
NEW guard (dpkg -s):    correctly reports No Installation Found
apt: Upgrading: 0, Installing: 0, Removing: 0

Happy to revert that bit if you'd rather keep the diff minimal.

Re-tested on a fresh Debian 13 unprivileged LXC: downgraded to 1.5.2, ran update_script() in-container via PHS_SILENT=1, upgraded back to 1.5.3 with the service healthy and private.key byte-identical.